This is a security release addressing two issues in specific configurations:
- Protected Content: If the feature is active, Authors filtering the admin list by private status could see other authors' private posts.
- Comments: If the feature is active and the site has password-protected posts, anonymous comment search could return those comments.
Fixed
- Prevent an array-to-string conversion warning in Custom Search Results when post terms are not a string. Props @burhandodhy and @leedxw via #4364.
Security
- Prevent an explicit private-status filter in the admin post list from exposing other authors' private posts, including custom private statuses, to users without
read_private_posts. Props @Zyy0530, @lzhou1110, @Str1ckl4nd, @mauriceng98, @7thParkk, @felipeelia, and @jeffpaul via #4366. - Prevent the Comments REST search from disclosing approved comments on password-protected posts to unauthenticated visitors. Props @mrglwglwgl and @felipeelia via #4366.
- Bumped
postcss-selector-parserfrom 7.1.0 to 7.1.5. Props @dependabot via #4363. - Bumped
fast-urifrom 3.1.5 to 3.1.7. Props @dependabot via #4363.
Developer
- Update
@wordpress/envfrom 11.13.0 to 11.15.0. Props @felipeelia via #4367.
See: https://github.com/10up/ElasticPress/milestone/96?closed=1